feat(profile): general update.

apparmor.d/groups/_full/systemd

@@ -141,20 +141,12 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
   /etc/machine-id r,
   /etc/modules-load.d/ r,
   /etc/networkd-dispatcher/{,**} r,
-  /etc/pipewire/** r,
-  /etc/polkit*/** r,
   /etc/systemd/{,**} r,
   /etc/udev/hwdb.d/{,*} r,
 
-  /var/lib/gdm{3,}/.config/pulse/{,**} rw,
-  /var/lib/gdm{3,}/.config/pulse/cookie k,
-  /var/lib/gdm{3,}/.config/dconf/user r,
-
         /var/lib/systemd/{,**} rw,
   owner /var/tmp/systemd-private-*/{,**} rw,
 
-  @{user_config_dirs}/pulse/{,**} rw,
-
   /tmp/namespace-dev-@{rand6}/{,**} rw,
   /tmp/systemd-private-*/{,**} rw,
 
@@ -173,7 +165,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
 
   @{sys}/bus/ r,
   @{sys}/class/ r,
-  @{sys}/class/power_supply r,
+  @{sys}/class/power_supply/ r,
   @{sys}/class/sound/ r,
   @{sys}/devices/@{pci}/** r,
   @{sys}/devices/**/net/** r,
@@ -219,6 +211,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
         /dev/ r,
         /dev/bus/usb/ r,
         /dev/hwrng r,
+        /dev/kmsg w,
         /dev/rfkill rw,
         /dev/shm/ rw,
         /dev/tty rw,

apparmor.d/groups/_full/systemd-service

@@ -14,12 +14,15 @@ profile systemd-service @{exec_path} flags=(attach_disconnected) {
   include <abstractions/base>
   include <abstractions/consoles>
 
-  capability sys_admin,
-
+  @{bin}/ldconfig      rix,
+  @{bin}/savelog       rix,
   @{bin}/systemctl     rix,
   @{coreutils_path}    rix,
   @{shells_path}      rmix,
-  @{bin}/ldconfig      rix,
+
+  # shadow.service
+  @{bin}/pwck          rPx,
+  @{bin}/grpck         rPx,
 
   @{bin}/grub-editenv  rPx,
   @{bin}/ibus-daemon   rPx,